Class Deviation 2026-O0025, Revision 3, issued September 3, 2026, adds a new DFARS clause — 252.240-7992, Prohibition on the Transfer of Certain Data of Department of Defense Employees to Third Parties (SEP 2026) — that prohibits contractors from selling, licensing, or otherwise transferring personally identifiable information about DoD personnel to anyone other than the Government. Most coverage of Revision 3 has focused on its treatment of the CMMC Phase 2 pause. This clause is the new substantive obligation, and it applies well beyond the defense industrial base's usual cyber perimeter.
Where it comes from
The clause implements 10 U.S.C. § 4662, added by section 803 of the FY2024 NDAA (Pub. L. 118-31) and amended by section 836 of the FY2025 NDAA (Pub. L. 118-159). The statute directs that each DoD contract entered into on or after December 22, 2023 include a provision barring the contractor and its subcontractors from selling, licensing, or otherwise transferring covered DoD employee data outside the Federal Government, except as required to perform the contract or as otherwise authorized by law. It gives the Secretary of Defense a waiver authority tied to privacy risk and national security, with annual reporting to Congress on each waiver used. Revision 3 is DoD's implementing text under the Revolutionary FAR Overhaul's DFARS Part 240.
What the regulation says
New DFARS 240.374 has three working parts:
- Definitions. "Covered personally identifiable information" means PII of DoD employees, including members of the Armed Forces, obtained by a contractor. PII is defined broadly: any information that can distinguish or trace an individual's identity alone or when combined with other linked or linkable information.
- Prohibition on award (240.374-2). Contracting officers are told not to award a contract to an entity that sells, licenses, or otherwise transfers covered PII to anyone other than the Federal Government, except to the extent required to perform the contract, when authorized by a waiver, or where the transfer is otherwise authorized by law.
- Clause prescription (240.374-3). Contracting officers insert 252.240-7992 in solicitations and contracts, including those for commercial products or commercial services, unless waived.
The clause itself is short. Paragraph (b) prohibits the contractor from selling, licensing, or otherwise transferring covered PII to anyone other than the Government except as required to perform the contract, and does not apply where the transfer is otherwise authorized by law. Paragraph (c) requires the contractor to insert the substance of the clause in all subcontracts or other contractual instruments, including subcontracts for commercial products and commercial services.
Why this is broader than it looks
Three features deserve attention.
It is not limited to CUI or to cyber clauses. Covered PII is any personal data about DoD civilians or service members that you obtain — badge and access rosters, training records, help-desk tickets, travel bookings, survey responses, customer-support logs. It does not need a CUI marking or a DFARS 252.204-7012 nexus.
It is written at the entity level. The award prohibition is phrased in terms of an entity that sells, licenses, or transfers covered PII — not only transfers made under the contract being awarded. Contractors that also run commercial data, analytics, or marketing lines should look at how DoD-personnel data flows across the whole enterprise, not one program.
"Other contractual instruments" includes your vendors. Cloud hosting, payroll and benefits platforms, CRM and marketing tools, analytics SDKs, and AI services often carry standard terms granting the vendor rights to use, aggregate, or share customer data. Where those vendors touch covered PII, their terms must be reconciled with the clause and the flowdown made. This sits naturally alongside your existing flowdown program.
What to do now
1. Search new DoD solicitations and modifications for 252.240-7992 and add it to your clause matrix. See the contract clause checklists. 2. Map where DoD-personnel PII lives and who can receive it — including SaaS tools and data-sharing arrangements — the same way you scope CUI. Our build-a-program guide walks through the inventory. 3. Review vendor and subcontract templates for the flowdown and for data-use rights that could amount to a "license" or "transfer." 4. Document the basis for each transfer (contract performance, legal authorization, or waiver). If a business model depends on DoD-personnel data, raise the waiver question with the contracting officer early.
This is a class deviation, so its text can change in later revisions or in the eventual DFARS rulemaking. Confirm the clause version in your actual contract. Use Find My Requirements to see how it fits with your other obligations, and our defense industry page for the broader picture.
Key Takeaways
- Class Deviation 2026-O0025, Revision 3 (September 3, 2026) adds DFARS 240.374 and clause 252.240-7992 (SEP 2026), implementing 10 U.S.C. § 4662.
- Contractors may not sell, license, or otherwise transfer PII of DoD employees or service members to anyone outside the Government except as needed to perform the contract, as otherwise authorized by law, or under a waiver, and contracting officers are directed not to award to entities that do.
- The clause applies to commercial acquisitions and must flow to all subcontracts and other contractual instruments, including commercial ones, so data mapping and vendor terms are now part of compliance.
This post is educational information, not legal advice. It does not create an attorney-client relationship.